Most people don’t go online thinking about their data. They want to read an article, make a donation, get in touch or support a cause. That’s exactly why privacy matters. At Winter Design, we build websites that respect people. Not just legally, but ethically. A privacy-conscious website starts with asking ‘what information are we asking for, and do we truly need it’?
Whose data do we collect, and how?
Every website collects some level of data. That might be a name and email address through a contact form, newsletter sign-ups, or technical details like browser type and IP address. None of this is unusual, but it’s important to be honest about it.
Transparent data usage
We focus on being clear about what data is collected through the websites we design and why it is collected. If someone fills in a form, it should be obvious what will happen next. We don’t want anyone, let alone our website visitors, receiving marketing they didn’t sign up for. If analytics tools are present, they should be there to genuinely improve the site rather than to harvest information for its own sake.
Third-party tools and tracking
A lot of privacy concerns come not from the site itself, but from the third-party services connected to it. Analytics monitoring, embedded content, social plugins and marketing tools can all introduce tracking that visitors aren’t always aware of.
When we build or review a site, we think carefully about these tools. Are they essential? Are there more privacy-respectful alternatives? And is what’s happening with the data explained clearly to users? We don’t always need to follow the default settings of a plugin or service.
There is a more general conversation around privacy and data happening across digital sectors (and life) too. Some organisations are questioning the long-term value of big tech platforms in the way they handle privacy and safety. For example, Lush has taken a principled stance on social platforms they no longer feel protect users or respect personal data – stepping back from platforms where they believe user privacy isn’t prioritised and encouraging more direct, ethical digital engagement. If organisations that big can choose to come away from social media, then there’s a clear opportunity here to disrupt ‘business as usual’.
What privacy looks like in practice
Respecting privacy doesn’t have to mean avoiding data collection entirely. It means:
- Being clear about what you collect and why
- Limiting unnecessary third-party tools
- Giving users genuine choice rather than opaque consent banners
- Avoiding tracking by default wherever possible
Privacy policies should explain in everyday language what information is collected, how it’s used and the rights people have over their data. Our own privacy notice reflects our approach.
Common website privacy questions…
Does my website need a cookie banner?
It depends on what your site is doing. If you only use cookies that are strictly necessary for the site to function, you don’t need a consent banner. If you use analytics, advertising or any non-essential tracking, you generally do — and the rules are stricter than many sites currently reflect. Consent must be freely given, with accepting and rejecting cookies made equally easy.
It’s worth knowing that the law has recently shifted. The Data (Use and Access) Act 2025 came into force in February 2026, introducing exemptions for certain low-risk cookies — including some basic analytics — from the usual consent requirement. But those exemptions are narrow, and the ICO only finalised its updated guidance in April 2026, so many sites are still catching up. If you’re in any doubt about where you stand, it’s worth getting your setup properly checked.
How do I check if my website is using cookies?
The quickest way is to open your website in Chrome or Firefox, right-click anywhere on the page and select ‘Inspect’. Head to the ‘Application’ tab (Chrome) or ‘Storage’ tab (Firefox) and look for ‘Cookies’ in the left-hand menu. Anything listed there is being set on your site. If you’re not sure what you’re looking at, or want a fuller picture of what’s being tracked and why, it’s worth asking your web agency to run through it with you. Feel free to get in touch if you would like our help.
Can I automatically add customers to my mailing list if they've bought from my website?
Not quite, but it’s more nuanced than a flat no. Under UK law (PECR, which works alongside UK GDPR), there’s a limited exception called the ‘soft opt-in’. If someone bought from you recently and didn’t opt out of marketing at the point of purchase, you may be able to email them about similar products or services without requiring explicit consent. But the marketing must be relevant to what they already bought, and you must always offer a clear and easy way to opt out. It doesn’t apply to charity fundraising, prospective customers, or anything unrelated to the original purchase. When in doubt, an explicit opt-in at checkout is always the safer approach.
What's the difference between a privacy policy and a cookie policy?
A privacy policy covers how your organisation collects, uses and stores personal data broadly, often through forms, enquiries, purchases and so on.
A cookie policy (sometimes combined into one document) specifically explains what cookies your site uses, what they do and how visitors can control them. Both should be written in plain language.
Do third-party tools on my website affect visitor privacy?
Yes, often significantly. Embedded fonts, social share buttons, video players and analytics platforms can all track visitors – sometimes even before they’ve consented. It’s worth reviewing which tools you actually need, whether there are more privacy-friendly alternatives, and whether your consent setup properly controls when they load.
What is GDPR and does it apply to my website?
The General Data Protection Regulation (GDPR) applies to any website that collects personal data about people in the UK – which, realistically, is most websites. It sets out how data must be collected, stored and used, and gives people rights over their own information. For anything involving cookies or electronic marketing, it works alongside a separate set of rules called PECR (Privacy and Electronic Communications Regulations). The ICO (Information Commissioner’s Office) is the official UK regulator and a useful first port of call if you want to understand your obligations in more detail. Non-compliance can result in fines, but beyond the legal risk, it’s simply good practice to handle people’s data with respect.
How do I make my website more privacy-conscious without removing all analytics?
You don’t have to choose between useful data and respecting your visitors. We often add Koko Analytics to our websites as it can be operated using a ‘no cookies’ mode which is really helpful. When using Google Analytics, some people worry that users declining cookies will skew their website data – but this isn’t the case. As long as the site is correctly configured for Google Consent Mode then the traffic data won’t be inaccurate.
Privacy-friendly analytics tools give you meaningful insight into how your site is performing, whilst others can be more invasive. We are happy to audit and advise on which tools we would recommend for your project – book a call today.
What should a good privacy notice include?
It should clearly explain what personal data you collect (names, emails, IP addresses and so on), why you collect it, the lawful basis you’re relying on for each type of data collection, how long you keep it, who you share it with, and what rights people have – including the right to access, correct or delete their data. To test your privacy notice, simply question whether a visitor could read it and actually understand what’s happening with their information? If not, it needs rewriting.
A privacy-conscious website isn’t just legally compliant, it also feels trustworthy. It acknowledges that visitors value control over their own information. We’re aware that privacy policies and respectful digital experiences aren’t the flashiest part of web design, but it’s hugely important and is something we believe more organisations should be thinking about.
If you’d like help making your website more privacy-aware, from auditing and consent to refining your messaging, we’re always happy to talk it through – get in touch today.
Back to Knowledge